Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I want to verify phone number ownership with specially crafted and encrypted payload within an HTTP hyperlink callback through SMS as opposed to sending an SMS OTP code and writing it back in server web page. The payload will contain validity and expiry, random numbers, etc.
I wasn't able to find anyone using this or similar method except for advertising purposes.
Am I hitting some obvious vulnerability that I'm not aware of?
Your proposal is to effectively use an SMS OTP code - but make it much longer than usual.
Your longer OTP code would be more resistant to brute force guessing, but there are better ways to counteract the problem of brute force attacks, for example:
SMS OTP is now looked down upon because SMS has many security weaknesses. The SMS message could be intercepted by someone else (using a SIM swap attack, or some sort of interception while the message is in transit), and if that happens, the longer URL-based OTP code won't offer any additional security.
Usability is the final issue - some people won't want to open the link on their phone (e.g. if they are logging in on a computer). Their phone might not even have a working web browser, or connection to the internet. A short code that they can type in to any device is more convenient.
